CLAIMS 

What is claimed is: 

1 1 . A method comprising: 

2 grouping single fields of a multiple-field source into a search target having 

3 multiple-field keys (MFKs) whose single fields correspond to the single fields in 

4 multiple- field vectors (MFVs) of entries in a data structure; 

5 generating a set of queries based, at least in part, on the MFKs, wherein each 

6 query has a different MFK as a lead MFK; 

7 using a query to determine whether the non-wildcard values in the MFVs of an 

8 entry match the non-wildcard values in corresponding MFKs of the search target; and 

9 using, if no entry has non- wildcard values in the MFVs that match the 



10 corresponding non-wildcard values in the MFKs, the queries to determine whether the 

1 1 entry has non-wildcard values in a MFV that match the non-wildcard values in a 

12 corresponding lead MFK, plus remaining MFVs that match corresponding remaining 

13 MFKs based on matching the non- wildcard values and wildcard values. 



1 2. The method of claim 1, wherein the entries of the data structure are stored 

2 such that the MFVs that have non-wildcard values are located at the end of the entry, 

1 .3. The method of claim 1 , further comprising arranging the entries of the 

2 data structure so that the MFVs that have non-wildcard values are placed at the end of the 

3 entry. 
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4. The method of claim 1 ; wherein the non-wildcard values comprise a fixed 
value and/or a range of fixed values. 

5. The method of claim 1 , further comprising: 

locating the entry having non-wildcard values in the MFV that match the non- 
wildcard values in the corresponding lead MFK, plus remaining MFVs that match 
corresponding remaining MFKs based on matching the non-wildcard values and wildcard 
values; and 

performing an operation associated with the located entry. 

6. The method of claim 1, wherein the multiple-field source comprises a data 
packet having single fields in its header. 

7. The method of claim 6, wherein the operation comprises one of the 
following: dropping the data packet, mirroring, metering, traffic shaping, rate limiting, 
accounting, statistics gathering, providing quality of service (QoS), redirecting to a 
central processing unit (CPU) for further processing, or sampling a subset of the packets 
to a CPU. 

8. The method of claim 1, wherein fewer than all MFVs in the entries 
include one single field. 

9. The method of claim 1, wherein the MFVs in the entries include two or 
more single fields. 
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1 10. An apparatus comprising: 

2 a data structure having a plurality of entries, wherein each entry has a group of 

3 multiple-field vectors that each include a number of single fields having all wildcard 

4 values or all non-wildcard values; and 

5 a search unit to group single fields of a multiple-field source into a search target 

6 having multiple-field keys (MFKs) whose single fields correspond to the single fields in 

7 multiple-field vectors (MFVs) of entries in a data structure, generate a set of queries 



8 based, at least in part, on the MFKs, wherein each query has a different MFK as a lead 

9 MFK, use a query to determine whether the non-wildcard values in the MFVs of an entry 
10 match the non-wildcard values in corresponding MFKs of the search target; and use, if no 



1 1 entry has non- wildcard values in the MFVs that match the corresponding non- wildcard 

12 values in the MFKs, the queries to determine whether the entry has non- wildcard values 

13 in a MFV that match the non- wildcard values in a corresponding lead MFK, plus 

14 remaining MFVs that match corresponding remaining MFKs based on matching the non- 

1 5 wildcard values and wildcard values. . 

1 11. The apparatus of claim 10, wherein the entries of the data structure are 

2 stored such that the MFVs that have non-wildcard values are located at the end of the 

3 entry. 

1 12. The apparatus of claim 10, wherein the search unit arranges the entries of 

2 the data structure so that the MFVs that have non-wildcard values are placed at the end of 

3 the entry. 
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1 13. The apparatus of claim 10, wherein the non- wildcard values comprise a 

2 fixed value and/or a range of fixed values. 

1 14. The apparatus of claim 10, wherein the search unit locates the entry 

2 having non-wildcard values in the MFV that match the non-wildcard values in the 

3 corresponding lead MF.K, plus remaining MFVs that match corresponding remaining 

4 MFKs based on matching the non-wildcard values and wildcard values; and performs an 

5 operation associated with the located entry; 

1 15. The apparatus of claim 1 0, wherein the multiple-field source comprises a 

2 data packet having single fields in its header. 

1 16. The apparatus of claim 15, wherein the operation comprises one of the 

2 following: dropping the data packet, mirroring, metering, traffic shaping, rate limiting, 

3 accounting, statistics gathering, providing quality of service (QoS), redirecting to a 

4 central processing unit (CPU) for further processing, or sampling a subset of the packets 

5 to a CPU. 

1 17. The apparatus of claim 10, wherein fewer than all MFVs in the entries 

2 include one single field. 

1 18. The apparatus of claim 10, wherein the MFVs in the entries include two or 

2 more single fields. 
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19. An article of manufacture comprising: 

a machine-accessible medium including thereon sequences of instructions that, 
when executed, cause an electronic system to: 

group single fields of a multiple-field source into a search target having multiple- 
field keys (MFKs) whose single fields correspond to the single fields in multiple-field 
vectors (MFVs) of entries in a data structure; 

generate a set of queries based, at least in part, on the MFKs, wherein each query 
has a different MFK as a lead MFK; 

use a query to determine whether the non- wildcard values in the MFVs of an 
entry match the non-wildcard values in corresponding MFKs of the search target; and 

use, if no entry has non-wildcard values in the MFVs that match the 
corresponding non-wildcard values in the MFKs, the queries to determine whether the 
entry has non-wildcard values in a MFV that match the non-wildcard values in a 
corresponding lead MFK, plus remaining MFVs that match corresponding remaining 
MFKs based on matching the non-wildcard values and wildcard values. 

20. The article of manufacture of claim 19, wherein the entries of the data 
structure are stored such that the MFVs that have non-wildcard values are located at the 
end of the entry. 

2 1 . The article of manufacture of claim 1 9, wherein the machine-accessible 
medium further comprises sequences of instructions that, when executed, cause the 
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3 electronic system to arrange the entries of the data structure so that the MFVs that have 

4 non-wildcard values are placed at the end of the entry. 



1 22. The method of claim 19, wherein the non- wildcard values comprise a 

2 fixed value and/or a range of fixed values. 

1 23. The article of manufacture of claim 1 9, wherein the machine-accessible 

2 medium further comprises sequences of instructions that, when executed, cause the 

3 electronic system to: 

4 locate the entry having non-wildcard values in the MFV that match the non- 

5 wildcard values in the corresponding lead MFK, plus remaining MFVs that match 

6 corresponding remaining MFKs based on matching the non-wildcard values and wildcard 

7 values; and 

8 perform an operation associated with the located entry. 

1 24. The article of manufacture of claim 19, wherein the multiple-field source 

2 comprises a data packet having single fields in its header. 

1 25. The article of manufacture of claim 24, wherein the operation comprises 

2 one of the following: dropping the data packet, mirroring, metering, traffic shaping, rate 

3 limiting, accounting, statistics gathering, providing quality of service (QoS), redirecting 

4 to a central processing unit (CPU) for further processing, or sampling a subset of the 

5 packets to a CPU. 
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1 26. The article of manufacture of claim 19, wherein fewer than all MFVs in 

2 the entries include one single field. 

1 27. The article of manufacture of claim 24, wherein the MFVs in the entries 

2 include two or more single fields. 

1 28. A system, comprising: 

2 a processor; 

3 a network interface coupled with the processor; and 

4 an article of manufacture comprising a machine-accessible medium including 

5 thereon sequences of instructions that, when executed, cause an electronic system to: 

6 group single fields of a multiple-field source into a search target having multiple- 

7 field keys (MFKs) whose single fields correspond to the single fields in multiple-field 

8 vectors (MFVs) of entries in a data structure; 

9 generate a set of queries based, at least in part, on the MFKs, wherein each query 

10 has a different MFK as a lead MFK; 

1 1 use a query to determine whether the non- wildcard values in the MFVs of an 

12 entry match the non- wildcard values in corresponding MFKs of the search target; and 

13 use, if no entry has non- wildcard values in the MFVs that match the 

14 corresponding non- wildcard values in the MFKs, the queries to determine whether the 

15 entry has non-wildcard values in a MFV that match the non-wildcard values in a 

16 corresponding lead MFK, plus remaining MFVs that match corresponding remaining 

17 MFKs based on matching the non- wildcard values and wildcard values. 
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1 29. The method of claim 28, wherein the non-wildcard values comprise a 

2 fixed value and/or a range of fixed values. 

1 30. The article of manufacture of claim 28, wherein the multiple-field source 

2 comprises a data packet having single fields in its header. 
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